Continuous Testing for security teams of every size
Human-led. AI-augmented. Continuous.
Rootshell Continuous Testing is the service: expert, CREST and Cyber Scheme accredited testers, working alongside Velma, our own AI tester, and delivered through the Rootshell Platform.
Continuous Penetration Testing with Velma AI Exploit Intelligence, Remediation Management and SLA Tracking, all year round. Retesting included.
Velma · Rootshell AI
New exploit published for a vulnerability in your results.
Now actively exploited. Moved to the top of your fix list.
That's Rootshell Continuous Testing.
Join 1,000+ leading companies who trust Rootshell Security
Testing services to suit your business
Every type of testing Rootshell delivers, whichever way you buy it. All results land in the Rootshell Platform.
Project-Based Penetration Testing
One-off, targeted engagements.
- Infrastructure (external and internal)
- Web application and web services
- Cloud: AWS, Azure, Microsoft 365
- Mobile (iOS and Android) and desktop apps
- Active Directory, firewall, VPN, Citrix, Wi-Fi
- Secure code review
- ICS, IoT and SCADA
- Phishing and physical security
Velma · Exploit intelligenceFlags exploits published against your findings, even after the report is delivered.
Continuous Penetration Testing
Ongoing testing through the contract: Core and Managed.
- Public web apps and IP assets
- Internal assets, endpoints and servers
- Cloud environments
- Sprint-aligned application testing
- Staff and physical security
Velma · Exploit intelligenceRe-ranks your fix list the moment an exploit appears in the wild.
External Attack Surface Management
Discover what you expose.
- Internet-facing assets and applications
- Analyst-triaged results
- Feeds straight into the platform
Velma · Exploit intelligenceWatches newly exposed assets for active exploitation.
Velma · Rootshell AI
See Velma in the platform →Continuous exploit intelligence across every service.
Velma tracks newly published and actively exploited vulnerabilities and moves what matters to the top of your fix list, whichever way you buy testing.
Web Application TestingApps, APIs and web services→Infrastructure TestingExternal and internal networks→In demandAI Penetration TestingTesting your AI systems→In demandOT / ICS and IoTIndustrial and connected devices→Mobile Application TestingiOS and Android apps→Ransomware Resilience AssessmentTest your defences before attackers do→Red Team as a ServiceRealistic adversary simulation→See all testing servicesBrowse every service→
Continuous by Design
Attackers don’t wait for your annual test, so neither do we.
Rootshell Continuous Testing runs for the whole of your contract. Our accredited testers find what matters, Velma watches for new and active exploits, and the Rootshell Platform turns every result into a prioritised fix, tracked to closure and retested.
Annual testing is a snapshot for compliance. Continuous testing follows your risk.
Exploit Intelligence
Prioritise by
Business Context
Remediation
Management
SLA
Tracking
Tracking
Compliance &
Reporting
Reporting
Continuous Testing levels
Choose the level of testing that fits your business
Every level is human-led, delivered through the Rootshell Platform, with free retests. Start where you are and step up as your needs grow.
In every level●Expert, accredited testers●Free retests●The Rootshell Platform●Velma, our AI tester
The Rootshell Platform
Every finding. Every exploit. One platform.
Your test results, vulnerability data and exploit intelligence in one live view, from Rootshell and from any other provider you use.
No static PDFs. No spreadsheets. No chasing. Your team sees what matters, who owns the fix and when it is due.
Active exploit detection
Velma flags new and active exploits against your results.
Discover Active Exploit Detection →
MCP server · Bring your own AI · Beta
See what an LLM adds →Bring your own AI to your security data.
Connect your own LLM to the Rootshell Platform through our MCP server and use it as your security analyst. Ask questions of your findings, exploit intelligence and remediation status in plain language.
New exploit available
Now actively exploited
Fix this first
Meet Velma
Part of our testing team. First to know when a vulnerability becomes a threat.
Velma is part of the Rootshell testing team. Our own AI tester works alongside our accredited human testers, backed by best-of-breed tools, and every engagement is human-led. Built into the Rootshell Platform, she also monitors new and active exploits against every vulnerability in your results, so your team knows what to fix first.
1
A new exploit appears
A public exploit is released for something in your results. Velma tells you straight away.
2
Attackers start using it
If it becomes actively exploited, Velma updates you again, so you know it has moved from possible to urgent.
3
Your team fixes what matters first
Priorities follow the threat, with Rootshell testers behind every decision.
AI Exploit Detection Service: included in Core and Managed.
Fix exploitable vulnerabilities before attackers use them.
Faster resolution where it matters most: critical, exploitable and actively exploited issues.
75%
MTTR decrease for critical rated issues
61%
MTTR decrease for exploitable issues
51%
MTTR decrease for active exploit issues
Customer success
Hear why the world’s top companies place their trust in us
Confidence that nothing is overlooked.
“What sets Rootshell Security apart from other providers is their strong sense of duty of care and personal approach to client services. Beyond their established alerting processes, their management team proactively reaches out to ensure important matters are brought to our attention and follow up with updates without prompting. That level of professionalism, diligence, and ownership gives us confidence that nothing is overlooked.”
JT
Justin Tombs
Security & Compliance Advisor, Imaginera
Intuitive, even for non-technical leaders.
“The Rootshell Platform gives me the visibility to easily understand issues, approve projects, and collaborate with colleagues so that our remediation process is as streamlined as possible. The platform is incredibly intuitive for non-technical leaders like me. The tooltips and training make it really easy to get the most out of the platform.”
SS
Stephen Shackell
Director of Intelligence and Risk, Zinc
Reassurance and improved efficiency.
“Rootshell’s services along side the remediation management platform, has provided reassurance and improved our efficiency around our pen testing programme.”
RS
Rex Slater
CISO, Edenred
Resources to help you
Frequently asked questions
Testing that runs throughout your contract. It is led by our accredited testers, augmented by Velma, our AI, and delivered through the Rootshell Platform.
Velma is part of the Rootshell testing team. Our own AI tester works alongside our accredited human testers, backed by best-of-breed tools, and every engagement is human-led. Velma also monitors new and active exploits against every vulnerability in your results, so your team knows what to fix first. In Managed, results are validated by our testers.
Core covers your internet-facing systems. Managed covers your wider environment, with our testers validating the results and a dedicated account manager.
Yes. Free retests are included at every level.
Results from Rootshell and from other providers sit in the Rootshell Platform, which works with the tools your team already uses.
Yes. Our MCP server, currently in beta, lets you connect your own LLM to the Rootshell Platform and use it as your security analyst. You can ask questions of your findings, exploit intelligence and remediation status in plain language. Talk to us about access.
Take back control of your cyber security
Rootshell was founded six years ago and is founder-led, drawing on more than 30 years of industry experience from previous successful businesses. We deliver thousands of testing days every year. CREST registered, Cyber Scheme accredited, ISO 27001 certified, an IASME Cyber Essentials Plus certification body, and NCSC CHECK scheme accredited.